diff options
| author | Brian Norris <computersforpeace@gmail.com> | 2010-11-10 22:31:41 -0800 |
|---|---|---|
| committer | Artem Bityutskiy <Artem.Bityutskiy@nokia.com> | 2010-11-13 13:53:07 +0200 |
| commit | a188ff405000902139a46d9e3753cae0e1168d46 (patch) | |
| tree | 25e7034e4b674e555875fa2c50fb6058abca0cf0 | |
| parent | a3d86d1d7679d082ba2b28b4ad2c57a4dd362df3 (diff) | |
mtd-utils: nandwrite: prevent 32-bit overflow
For large block- and page-sizes, the multiplication of ebsize_aligned
and pagelen can overflow a 32-bit integer. This overflow can be
prevented by a simple change in order of operations (i.e., do division
first).
Since ebsize_aligned is always a multiple of mtd.min_io_size, this
produces no change in results.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Acked-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
| -rw-r--r-- | nandwrite.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/nandwrite.c b/nandwrite.c index 8ec5afe..aea7572 100644 --- a/nandwrite.c +++ b/nandwrite.c @@ -440,8 +440,13 @@ int main(int argc, char * const argv[]) goto closeall; } - // Allocate a buffer big enough to contain all the data (OOB included) for one eraseblock - filebuf_max = pagelen * ebsize_aligned / mtd.min_io_size; + /* + * Allocate a buffer big enough to contain all the data (OOB included) + * for one eraseblock. The order of operations here matters; if ebsize + * and pagelen are large enough, then "ebsize_aligned * pagelen" could + * overflow a 32-bit data type. + */ + filebuf_max = ebsize_aligned / mtd.min_io_size * pagelen; filebuf = xmalloc(filebuf_max); erase_buffer(filebuf, filebuf_max); |